I received an alert, or queried some logs, where the username is displayed as "HIDDEN_DUE_TO_SECURITY_REASONS". Why is that?
This username masking is actually performed by CloudTrail, not Panther. AWS provides the following explanation:
The userName field contains the string HIDDEN_DUE_TO_SECURITY_REASONS when the recorded event is a console sign-in failure caused by incorrect user name input. CloudTrail does not record the contents in this case because the text could contain sensitive information, as in the following examples:
A user accidentally types a password in the user name field.
A user clicks the link for one AWS account's sign-in page, but then types the account number for a different one.
A user accidentally types the account name of a personal email account, a bank sign-in identifier, or some other private ID.